CVE-2023-54355

PocketMine-MP, a widely used PHP-based server implementation for Minecraft: Bedrock Edition, fails to verify that the identityPublicKey in login packets uses the required secp384r1 (NIST P-384) elliptic curve, an improper cryptographic verification flaw (CWE-347). A remote, unauthenticated attacker can send a LoginPacket whose key uses a different curve or a non-elliptic-curve key type; the key passes the initial login verification, but an uncaught exception is thrown later during ECDH shared-key derivation. The uncaught exception crashes the server process, giving the attacker full availability impact — a pre-authentication remote denial of service (CVSS 4.0: 8.7 High, availability-only). All deployments running PocketMine-MP before 5.3.1 in the 5.x branch or before 4.23.1 in the 4.x branch are affected, especially servers publicly reachable on the Bedrock protocol port. Exploitation is not currently documented: the issue is not in CISA KEV and no public proof-of-concept is known, though the attack is straightforward for anyone aware of the flaw.

What to do: Upgrade to PocketMine-MP 5.3.1 or later, or to 4.23.1 or later if you must remain on the 4.x branch. Because the flaw is pre-authentication, there is no in-product toggle to mitigate it; until you patch, restrict access to the Bedrock protocol port (default 19132/UDP) with firewall rules or server allowlists so only trusted players can reach the server. Note that any publicly reachable server can be crashed repeatedly, so treat patching as urgent for community-facing deployments.